Privacy policy

applyNchill is operated by [registered name], at [registered address]. Where this document says "we", that is who it means.

applyNchill is also open source and can be run by anyone on their own machine or their own server. This policy covers the deployment you are reading it on. If you or your employer are running your own copy, no data reaches us at all, and the operator of that copy is the one accountable for it.

Questions about anything here go to privacy@applynchill.com.

Before Setup lets you upload a résumé, fill in your details or save a key, it asks you to tick a box saying you have read this policy and agree to your data being stored and used as it describes. The box is never ticked for you. We record the date you ticked it and which version of this policy it was.

Whatever you upload or enter is used exactly as you give it, to fill in application forms for you. We do not check that the information is true, and keeping it accurate is your responsibility. What we do check is that it is safe to accept: see “What we check before accepting it” below.

Setup is not the only safeguard. The server itself refuses to store a résumé, profile, API key or mailbox from an account that has not agreed. That applies to requests from the extension too. You can still view, download and delete your data without agreeing.

If this policy changes in a way that affects what we do with your data, the version changes and Setup asks you again. Agreeing to an older version does not count as agreeing to a newer one.

You can withdraw your consent at any time. This product cannot apply for you without processing your data, so withdrawing means deleting your account. Section 10 explains how, and what happens to each kind of data.

Most of this is something you gave us or something the product made for you. The exceptions are the activity record and the request logs, which the server writes as you use it. Both are described below. Nothing here is bought, and nothing is taken from data brokers.

Stated as plainly as the list above, and only where it is true.

• ·No analytics or advertising. There is no analytics script, tag manager, session recorder, heat map or advertising pixel on this site.
• ·No third-party fonts. Fonts are bundled with the site and the extension. The one third-party script is Razorpay’s checkout, and it loads only on the payment page, when you pay.
• ·No tracking across sites. We do not set, read or buy any identifier that follows you onto other sites.
• ·No browsing history, cookies, screenshots or email from the extension. The extension does not read your browsing history or other sites’ cookies, does not take screenshots, and does not read your email.

The extension has permission to run on every website, not only job portals. It needs this because an application can move from one site to another partway through, and because it shows its “needs you” prompt in whichever tab you are using. It reads and fills the page an application is on. It does not send anything from your other tabs to us.

You may give this service three kinds of credential, and they are not all protected the same way. Here is each one.

Outreach mailbox password

Encrypted in the database with AES-256-GCM. The encryption key is kept in the server’s environment, not in the database, so a copy of the database on its own does not reveal the password. It is only ever used to send mail from your mailbox, and it is never sent anywhere else.

Mistral API key

Encrypted in the database with AES-256-GCM, the same way as the mailbox password. Your browser extension needs the key itself to call Mistral, so the server decrypts it and sends it to the extension, at most 60 times an hour per account. From extension version 2.19.0 the extension keeps it only in the browser’s memory (Chrome’s session storage), never on disk, and fetches it again after 10 minutes, when you switch accounts, or when the browser restarts. Earlier versions kept a copy on disk; updating the extension deletes that copy.

Job-portal password

Stored without encryption in your profile. It is also included in the instructions the extension sends to Mistral, so the AI can fill a “create account” or “sign in” page. If you have not set one, the extension uses a default password that is not unique to you. Set your own before applying on Workday.

What we check before accepting it:

• ·Résumé files (PDF, DOCX or DOC). We open the file and check what it really is, whatever its name says. A file renamed to .pdf is refused. So is a document containing scripts, macros, embedded files or programs, actions that run when it is opened, content loaded from the internet, or links other than web, email and phone links.
• ·Mistral API keys. A key must be letters and digits only, and we test it with Mistral before saving it. A key Mistral rejects is not saved.
• ·Mailbox app passwords. A Gmail app password must be exactly 16 letters, so your real Google password is refused rather than stored. The mail server must be a public mail host on a standard mail port. We check this again every time we connect.

Encryption protects against a copy of the data getting out, such as a backup, a database dump or a successful injection attack. It does not protect against someone who takes control of the running server, because the server has to be able to read what it uses.

How to limit the risk. Use a Mistral key made only for this service, so you can revoke it without affecting anything else. For outreach, use an app password, never your real mailbox password: you can revoke it from your mail account at any time without involving us. For job portals, choose a password you do not use anywhere else.

Because of the outreach feature, this database holds information about people who are not our users: recruiters and hiring staff. For each one it holds a name, job title, employer and work email address, and a record of what was sent to them and when.

Here is where that information comes from. Names and job titles come from a limited number of LinkedIn people searches, run by the service under one account. Addresses come from what a company publishes on its own website, or from the company’s address format, checked against its own mail server. They are always work addresses at the company in question. Every message goes out from your own mailbox, under your name.

This contact list is shared across the service rather than belonging to one user, so it stays when a user deletes their account. When you mark an address as bounced, that mark is shared as well, so nobody else emails a dead address.

If you are one of those people and would rather not be listed, write to privacy@applynchill.com and we will remove your record. You do not need an account to ask, and you do not need to give a reason.

You are the sender. The messages go out from your mailbox, so you are responsible for them under the rules on unsolicited email where you and the recipient are. Keep the numbers small, keep the messages relevant, and stop when someone asks you to.

We do not sell data and we do not share it for advertising. The organisations below receive some of it, each for one specific reason.

Company logos are fetched by the server from DuckDuckGo and Google using only the company’s web address. No information about you is sent. Apart from the organisations above, we disclose data only when the law requires it, and we will tell you when that happens unless we are legally prevented from doing so.

On this site: two cookies that keep you signed in, one security (CSRF) token, and a short-lived cookie used only while you sign in with Google or GitHub. Your browser’s local storage also holds your theme and your cookie choice. None of it is used for tracking. Each one is named and explained on the cookie preferences page.

In the extension, Chrome’s local storage on your computer holds: your sign-in token, a random id for this browser, copies of your résumé files, and answers you accepted to multiple-choice screening questions, kept so you are not asked the same question twice. The saved answers never leave your computer. Your Mistral key is not on that list: from version 2.19.0 it is held only in the browser’s memory and is gone when the browser closes. Signing out removes the sign-in token. Removing the extension removes all of it.

Your account and work

For as long as the account exists. The application history is what the product is for, so we do not delete any of it while you have an account.

Activity record

For as long as the account exists, with its IP addresses.

Assistant conversations

30 days after the last message in a conversation, then deleted. “Start over” in the assistant deletes the conversation at once.

Sessions

A session lasts up to 14 days, and its short-lived access token is replaced every 15 minutes. When a session ends, it is marked as ended rather than deleted. That way, if someone tries to reuse a stolen token, we can tell.

Server logs

Every request to the server is logged with its IP address, browser user-agent, page address and, if you are signed in, your account id. We keep these logs for 14 days, and performance traces for 72 hours. Error reports sent from your browser, including the page you were on and the error, are part of the same logs.

Backups

The database and uploaded files are backed up every night. We keep 7 daily and 4 weekly backups, so a backup can be up to about five weeks old.

Payment records

Kept for as long as tax and accounting law requires, including after the account is deleted. See the next section.

Account-sharing checks

For as long as the account exists. When the account is deleted, the hashes are detached from it and kept for 90 days, then deleted. See the next section.

The job listings

Jobs collected from public job boards are shared by everyone on this service and are not personal data. They are deleted after a set period.

Delete your account yourself, or ask us to. It is deleted for real, not just hidden, in one step, from every table that holds your data:

• ·your sign-in details, and every session on every device
• ·the verification and password-reset links we emailed you
• ·your daily counters, your plan passes and your API keys
• ·your profile: name, phone, address, work history and job-portal password
• ·the CVs you uploaded and the tailored versions, deleted from the server’s disk
• ·the roles you target, your ranked jobs and your swipes
• ·your application history and logs, including anything still queued or in progress
• ·your outreach mailbox, message template, attachment, contacts and send history
• ·the activity record of your account

Some data outlasts the account, and here is what, and for how long:

• ·Payment records stay, detached from your account, because the law requires us to keep them. Razorpay keeps its own copy under its own policy.
• ·The one-way hashes used for account-sharing checks stay for 90 days, detached from your account, so that deleting an account and signing up again does not reset a free allowance. They cannot be turned back into your phone number, email or keys, and they are deleted after 90 days.
• ·Server logs are deleted within 14 days, and backups within about five weeks. We do not restore deleted accounts from backups.
• ·If you are an administrator, records of changes you made to other people’s accounts stay with those accounts.
• ·The shared recruiter contact list (section 6) stays, because it does not belong to any single user.
• ·The extension’s storage on your computer is not affected. Remove the extension to clear it.
• ·Applications you already submitted stay with the employers who received them. We cannot reach into an employer’s system, and neither can you through us.

To delete your account yourself, sign in and go to Setup → Your data. You can download a copy of your data there first. Or email privacy@applynchill.com from the address on your account.

• ·Passwords for your applyNchill account are stored as bcrypt hashes. Nobody can read yours, including us.
• ·Session tokens are stored as SHA-256 hashes, so a copy of the session table cannot be used to sign in as anyone.
• ·Session cookies are HttpOnly, so scripts on the page cannot read them. They are also SameSite=Lax, so other websites cannot make your browser send them.
• ·Every request that changes something must include a CSRF token, which another website cannot get.
• ·All traffic is encrypted with TLS.
• ·Your outreach mailbox password and your Mistral key are encrypted in the database. Your job-portal password is not. Section 5 explains why, and what you can do about it.
• ·Every database query is limited to your own account. We do not rely on simply hiding other people’s data in the interface.

None of this guarantees nothing will go wrong. If you find a security problem, email security@applynchill.com. We will never threaten legal action over a report made in good faith.

• ·A copy of your data. Setup → Your data gives you a download straight away: your profile, applications, uploaded and tailored résumés, and the database rows for your account, without passwords or keys.
• ·Corrections to anything that is wrong. You can edit most of it yourself in Setup, which is faster than asking us.
• ·Deletion of your account and everything in it.
• ·To withdraw your consent. For this product, that is the same as deleting your account.
• ·To object, or to complain to your data-protection authority, without contacting us first.

Email privacy@applynchill.com from the address on your account. We reply within 30 days, and there is no charge.

This is a tool for applying to jobs, and it is not meant for anyone under 18. We do not knowingly hold data about children. If we find that we do, we delete it.

The date at the top is when this policy last changed. If a change affects what we do with your data, we will email account holders before it takes effect, and Setup will ask for your consent again.